Add subscription exclusions using management groups

[cata008]

Hi @DCMattyG. I believe it could turn out quite handy to have the option to select a management group id as filter and exclude all subscriptions within. Especially for organizations designed using the Cloud Adoption Framework.

Cheers,
Cata

[DCMattyG]

Hi @cata008, while I do agree that this is a good idea, I don't believe it will be possible based on how filtering of Azure Resource Graph queries work. Currently the Azure IPAM platform calls out to ARG at the Root Management Group (Tenant) level so that it has visibility across the entire Tenant. While you can filter like this:

| where subscription_id !in~ <RESULTS>

But there isn't a way to perform the similar (that I am aware of) based on Management Groups as this data isn't part of the child resources. In theory, you could JOIN a query for all of the Management Groups, then look at the Subscriptions that live within those Management Groups, then filter on those Subscriptions, however there are a finite number of JOIN's that can be called in an Azure Resource Graph Query (when used via API/SDK) and the queries that we use right now are already quite large.

I'll continue to explore various ways that we might be able to better accomplish this, but it may take some time due to the complexities of how Azure Resource Graph works and it's current limitations.

[cata008]

Hi @DCMattyG. Can't we do something similar to the query below? Thanks for looking into it!

ResourceContainers
| where type =~ 'microsoft.management/managementgroups'
| extend  mgParent = properties.details.managementGroupAncestorsChain
| mv-expand with_itemindex=MGHierarchy mgParent
| project name, properties.displayName, mgParent, MGHierarchy, mgParent.name
| where mgParent_name == "<tenant-root-mg-id>"
| project mgname = name
| join kind=leftouter (resourcecontainers | where type=~ 'microsoft.resources/subscriptions'
| extend  mgParent = properties.managementGroupAncestorsChain | project id, mgname = tostring(mgParent[0].name)) on mgname

[DCMattyG]

Indeed @cata008, we could do something like this, however here is what needs to be considered...

1. We would likely need to fetch the Management Group/Subscription mappings before every API call as we don't know when these might change, so the only way to be 100% sure is to check again every time. We could cache the results for a bit, but that means that things could change in Azure and we'd be returning incorrect data until the cache expires. Adding this as a pre-call before every API call will add latency to every API response, and finally Azure Resource Graph is throttled at 15 calls per second, and this will double the number of API calls, likely causing some extreme throttling (reference).

2. Another option in that we could add these as a JOIN to the existing calls, however there is a maximum of 3 JOINS and many of the queries we use are already maxed out (reference).

So you see, we need to figure out an ideal way to handle this knowing that, especially in larger environments, the Management Group/Subscription mapping could change at any time due to other users working within the Azure environment, and how do we address that from the Azure IPAM side if we're specifying a Management Group to be excluded.

[DCMattyG]

Hi @cata008, thanks for a great discussion during our Teams call. After getting a much better clarity around the ask here, I'm happy to announce this item has been completed in PR #204. If you're using the default deployment, you can simply restart your App Service to pull the updated containers.

You should now see Management Groups in the Exclusions section, and you can filter/sort by this column:

If for some reason you don't see this, it may be because you've already saved a customer view on this page and need to reset the view to default as follows:

If you need the full Management Group ID, this is also available though it's hidden by default (because it's quite long):

Hope this meets your need sir, and as always thanks for the wonderful feedback!

[cata008]

Thanks @DCMattyG ! So much easier to add the exclusions. :)

[serottez]

@DCMattyG Hi Matt, does this pull request enable excluding all Subscriptions in a Management Group from IPAMs visibility, or does this PR simply detail what management group an excluded subscription is apart of? Hope that makes sense, thank you!

[DCMattyG]

At this point in time, the list is by Subscription only. The reason behind this has to do with where Management Groups sit in-between Entra ID and Azure, and what data comes back with Azure Resource Graph queries, etc.

I am continuing to work on a way to add an exclusions at a Management Group level in the future.

[serottez]

Thank you for the quick response!

I have a follow-up question: when you "exclude" a subscription, what functional effect does that have? Does that simply remove the subscription from the GUI display, or does it modify the configurations of the Azure resources used by IPAM to remove the "excluded" subscriptions from their permissions scope, etc.?

[DCMattyG]

The tool will completely ignore that Subscription. Azure IPAM uses Azure Resource Graph queries to gather data, and any excluded Subscription is excluded from the ARG results.

Azure IPAM does not manipulate Azure in any way/shape/form. It only has Reader permissions.

[serottez]

IPAM resources only having reader permissions in the tenant makes me more comfortable using it. Thank you, Matt.

[DCMattyG]

You bet!